White House confirms Russian government spies hacked the U.S. Treasury and Commerce Department and monitored staff emails for months

 Hackers backed by the Russian government have been monitoring internal email traffic at the U.S. Treasury Department and the Department of Commerce for months, according to reports. 

The hack involves the National Telecommunications and Information Administration's office software, Microsoft's Office 365. Staff emails at the agency were monitored by the hackers for months, sources told Reuters. 

National Security Council spokesman John Ullyot said: 'The United States government is aware of these reports and we are taking all necessary steps to identify and remedy any possible issues related to this situation.'

The hack was carried out by a group known as APT29 or Cozy Bear and working for SVR, the Russian foreign intelligence service, The Washington Post reported Sunday. 

 'This is a nation state,' said a different person briefed on the matter had told Reuters. 'We just don't know which one yet.'

There is concern within the U.S. intelligence community that the hackers who targeted the Treasury Department and the NTIA used a similar tool to break into other government agencies, according to three people briefed on the matter. The people did not say which other agencies.

+2

Hackers backed by a foreign government have been monitoring internal email traffic at the U.S. Treasury Department, pictured, and an agency that decides internet and telecommunications policy, according to people familiar with the matter

The hack is so serious it led to a National Security Council meeting at the White House on Saturday, said one of the people familiar with the matter.

A Microsoft spokesperson did not immediately respond to a request for comment.

The hackers are 'highly sophisticated' and have been able to trick the Microsoft platform's authentication controls, according to a person familiar with the incident, who spoke on condition of anonymity because they were not allowed to speak to the press.

Sources said that the breaches are connected to a broad campaign that also involved the recently disclosed hack on FireEye, a major U.S. cybersecurity company with government and commercial contracts. 

Last Tuesday, FireEye said that foreign government hackers with 'world-class capabilities' broke into its network and stole offensive tools it uses to probe the defenses of its thousands of customers. Those customers include federal, state and local governments and top global corporations. 

The full scope of the hack is unclear. The investigation is still its early stages and involves a range of federal agencies, including the FBI, according to the three people familiar with the matter.

The FBI, Homeland Security Department's cybersecurity division, known as CISA, and U.S. National Security Agency did not immediately respond to a request for comment. 

The director of the Cybersecurity and Infrastructure Agency, Christopher Krebs, was fired in a November 17 tweet by Donald Trump. 

+2

The hack is so serious it led to a National Security Council meeting at the White House on Saturday, said one of the people familiar with the matter (stock image)

The breach presents a major challenge to the incoming administration of President-elect Joe Biden as officials investigate what information was stolen and try to ascertain what it will be used for. 

It is not uncommon for large scale cyber investigations to take months or years to complete.

'This is a much bigger story than one single agency,' said one of the people familiar with the matter. 'This is a huge cyber espionage campaign targeting the U.S. government and its interests.'

There is some indication that the email compromise at NTIA dates back to this summer, although it was only recently discovered, according to a senior U.S. official.

NTIA was among a group of agencies involved in the Trump administration's effort to ban Chinese social media apps Tiktok and WeChat. The Trump administration has said such apps pose a national security threat. The affected Chinese companies deny the claim.